CVE-2023-20273 Cisco IOS XE Web UI Command Injection

Exploited in the wild High 7.2 Published 24 Oct 2023 Updated 21 Oct 2025

Authenticated attackers can inject OS commands with root privileges via the web UI due to insufficient input validation.

Exploited in the wild: Since 23 Oct 2023
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-20273?

CVE-2023-20273 is a high-severity command injection vulnerability in Cisco Ios Xe, published on 24 Oct 2023. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands with the privileges of root. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted input to the web UI. A successful exploit could allow the attacker to inject commands to the underlying operating system with root privileges.

Weakness: CWE-78

Which versions are affected by CVE-2023-20273?

It affects 1 product.

Products include Cisco Ios Xe.

How do I fix CVE-2023-20273?

No fix has been published for CVE-2023-20273 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 27 Oct 2023.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2023-20273 being exploited?

Yes. Attackers have exploited CVE-2023-20273 in the wild since at least 23 Oct 2023.

Public exploit code: 2 Metasploit modules and 1 proofs of concept on GitHub.

All Cisco Ios Xe vulnerabilities

Sources

Also known as GHSA-xm3x-5hpf-5369.